Remove compiler warnings for spring-security-oauth2-authorization-server by gisu1102 · Pull Request #18562 · spring-projects/spring-security

gisu1102 · 2026-01-23T05:35:21Z

Summary

Closes #18432

AOT/runtime hints in the OAuth2 Authorization Server module
- Before: Included ACCESS_DECLARED_FIELDS, which is no longer applicable in Spring Framework 7 and could trigger compiler warnings.
- After: Removed ACCESS_DECLARED_FIELDS, keeping only the required INVOKE_DECLARED_* categories.
Deprecated Jackson2 adapter usage
- Before: Deprecated Jackson2 adapter types were used without explicit removal suppression.
- After: Added @SuppressWarnings("removal") only to deprecated Jackson2 adapter classes to document intentional usage.

Testing

./gradlew --no-build-cache clean :spring-security-oauth2-authorization-server:check

Notes

Other module warnings are unchanged and outside this module’s scope.

@SuppressWarnings

Remove compiler warnings in spring-security-oauth2-authorization-server - Remove ACCESS_DECLARED_FIELDS from AOT/runtime hints - Add @SuppressWarnings("removal") for Jackson2 deprecated adapters Closes spring-projectsgh-18432 Signed-off-by: gimgisu <gisu1102@gmail.com>

rwinch

Thanks for the PR! I've responded with a few comments. Please keep in mind that there are a few examples of me wanting to understand why the deprecated fields in MemberCategory were not migrated according to the Javadocs, but this is a general question and should be considered throughout the whole pull request.

rwinch · 2026-01-23T20:36:29Z

...th2/server/authorization/aot/hint/OAuth2AuthorizationServerBeanRegistrationAotProcessor.java

 			// Jackson Modules
 			if (jackson2Present) {
 				hints.reflection()
 					.registerTypes(


This needs to continue to register the jackson 2 modules for passivity. You can extract it into a separate method and add a suppression to it.

Agreed. Jackson 2 module registration is still required for passivity when Jackson 2
is present on the classpath.

I will keep the Jackson 2 registrations, extract them into a dedicated helper method,
and scope @SuppressWarnings("removal") to that method only so the intent is explicit
while preserving the existing behavior.

Jackson 3 module registration will remain unchanged.
Thank you.

rwinch · 2026-01-23T20:44:21Z

...th2/server/authorization/aot/hint/OAuth2AuthorizationServerBeanRegistrationAotProcessor.java

+			hints.reflection()
+				.registerType(Collections.class, MemberCategory.INVOKE_DECLARED_CONSTRUCTORS,
+						MemberCategory.INVOKE_DECLARED_METHODS);


This and the similar changes don't seem to be a one to one change from deprecation to replacement. For example, I'd expect this change to be as shown in this suggestion since the deprecation for DECLARED_CLASSES states it is deprecated with no replacement since registerType registers the class.

Suggested change

hints.reflection()

.registerType(Collections.class, MemberCategory.INVOKE_DECLARED_CONSTRUCTORS,

MemberCategory.INVOKE_DECLARED_METHODS);

hints.reflection().registerType(Collections.class);

Can you help me understand why these changes do not appear to be a one to one replacement for the deprecations?

Thanks for the clarification.

You're right — my change removed MemberCategory.DECLARED_CLASSES but didn’t make it explicit that the type itself is still being registered.
Since DECLARED_CLASSES is deprecated with no replacement (because registerType already registers the class), I’ll add an explicit
hints.reflection().registerType(T.class) alongside the existing INVOKE_* categories. This preserves the original “type registration”
intent while keeping the reflective invocation hints where needed.

rwinch · 2026-01-23T20:46:38Z

...th2/server/authorization/aot/hint/OAuth2AuthorizationServerBeanRegistrationAotProcessor.java

 			hints.reflection()
-				.registerType(HashSet.class, MemberCategory.DECLARED_FIELDS,
-						MemberCategory.INVOKE_DECLARED_CONSTRUCTORS, MemberCategory.INVOKE_DECLARED_METHODS);
+				.registerType(HashSet.class, MemberCategory.INVOKE_DECLARED_CONSTRUCTORS,


Can you help me understand why MemberCategory.DECLARED_FIELDS wasn't migrated to MemberCategory.INVOKE_DECLARED_FIELDS as documented within the Javadoc?

Thank you for pointing this out.

You’re right — MemberCategory.DECLARED_FIELDS should be migrated to MemberCategory.ACCESS_DECLARED_FIELDS as documented in the Javadoc.

In my earlier change, I removed DECLARED_FIELDS without explicitly replacing it with ACCESS_DECLARED_FIELDS, which made the migration look incomplete and not 1:1.

I’ve updated the code so that:

All previous DECLARED_FIELDS usages are now migrated to
ACCESS_DECLARED_FIELDS.

INVOKE_DECLARED_CONSTRUCTORS / INVOKE_DECLARED_METHODS are kept only where
reflective invocation was already required.

This preserves the original intent of field access while aligning with the documented replacement in Spring Framework 7.

Restore Jackson 2 module runtime hints for passivity - Keep Jackson 2 module registrations when jackson2 is present - Extract Jackson 2 hint registration into a dedicated method - Suppress removal warnings only for the Jackson 2 registration Closes spring-projectsgh-18432 Signed-off-by: gimgisu <gisu1102@gmail.com>

Align AOT hints with MemberCategory deprecation replacements - Replace DECLARED_FIELDS with ACCESS_DECLARED_FIELDS in runtime hints - Preserve 1:1 intent for Collections via registerType only - Keep INVOKE_* only where it existed before Closes spring-projectsgh-18432 Signed-off-by: gimgisu <gisu1102@gmail.com>

gisu1102 · 2026-01-24T05:21:11Z

@rwinch
Thanks for the review!

I’ve addressed all of the requested changes:

Restored Jackson2 module registration for passivity
Migrated DECLARED_CLASSES and DECLARED_FIELDS 1:1 according to the Spring Framework 7 Javadocs

Could you please take another look when you have a moment?

rwinch · 2026-01-26T20:39:10Z

Thank you for the updates! This will be merged once the build passes

gisu1102 · 2026-01-27T01:16:00Z

Thank you for the updates! This will be merged once the build passes

Thanks for the review and the helpful comments.
I’ll check the build and formatting issues and follow up with an update shortly.

Apply code formatting to OAuth2AuthorizationServerBeanRegistrationAotProcessor Closes spring-projectsgh-18432 Signed-off-by: gimgisu <gisu1102@gmail.com>

gisu1102 · 2026-01-30T01:07:42Z

@rwinch Auto-merge seems disabled after my latest push—would you mind re-enabling it when you get a chance? Thanks!

rwinch · 2026-02-03T13:57:29Z

Thanks for the PR @gisu1102 This is now merged into main

gisu1102 force-pushed the fix/18421-remove-compiler-warnings-crypto branch 2 times, most recently from 98b1478 to 2218ebe Compare January 23, 2026 05:39

spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Jan 23, 2026

gisu1102 closed this Jan 23, 2026

gisu1102 reopened this Jan 23, 2026

@gisu1102

e0ef1d6

Remove compiler warnings in spring-security-oauth2-authorization-server - Remove ACCESS_DECLARED_FIELDS from AOT/runtime hints - Add @SuppressWarnings("removal") for Jackson2 deprecated adapters Closes spring-projectsgh-18432 Signed-off-by: gimgisu <gisu1102@gmail.com>

gisu1102 force-pushed the fix/18421-remove-compiler-warnings-crypto branch from 2218ebe to e0ef1d6 Compare January 23, 2026 05:51

gisu1102 mentioned this pull request Jan 23, 2026

Remove compiler warnings for spring-security-crypto #18421

Open

rwinch requested changes Jan 23, 2026

View reviewed changes

rwinch added status: waiting-for-feedback We need additional information before we can continue in: build An issue in the build type: enhancement A general enhancement and removed status: waiting-for-triage An issue we've not yet triaged labels Jan 23, 2026

gisu1102 added 2 commits January 24, 2026 13:02

spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Jan 24, 2026

rwinch added this to the 7.1.0-M2 milestone Jan 26, 2026

rwinch self-assigned this Jan 26, 2026

rwinch added in: oauth2 An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose) and removed status: feedback-provided Feedback has been provided labels Jan 26, 2026

rwinch enabled auto-merge (rebase) January 26, 2026 20:38

@gisu1102

41c9f9f

Apply code formatting to OAuth2AuthorizationServerBeanRegistrationAotProcessor Closes spring-projectsgh-18432 Signed-off-by: gimgisu <gisu1102@gmail.com>

auto-merge was automatically disabled January 27, 2026 01:22
Head branch was pushed to by a user without write access

rwinch enabled auto-merge (rebase) February 3, 2026 01:14

rwinch approved these changes Feb 3, 2026

View reviewed changes

rwinch merged commit 4602797 into spring-projects:main Feb 3, 2026
6 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove compiler warnings for spring-security-oauth2-authorization-server#18562

Remove compiler warnings for spring-security-oauth2-authorization-server#18562
rwinch merged 4 commits intospring-projects:mainfrom
gisu1102:fix/18421-remove-compiler-warnings-crypto

gisu1102 commented Jan 23, 2026 •

edited

Loading

Uh oh!

rwinch left a comment

Uh oh!

rwinch Jan 23, 2026

Uh oh!

gisu1102 Jan 24, 2026

Uh oh!

rwinch Jan 23, 2026

Uh oh!

gisu1102 Jan 24, 2026

Uh oh!

rwinch Jan 23, 2026

Uh oh!

gisu1102 Jan 24, 2026

Uh oh!

gisu1102 commented Jan 24, 2026

Uh oh!

rwinch commented Jan 26, 2026

Uh oh!

gisu1102 commented Jan 27, 2026

Uh oh!

gisu1102 commented Jan 30, 2026

Uh oh!

Uh oh!

rwinch commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

gisu1102 commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Notes

Uh oh!

rwinch left a comment

Choose a reason for hiding this comment

Uh oh!

rwinch Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

gisu1102 Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

rwinch Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

gisu1102 Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

rwinch Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

gisu1102 Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

gisu1102 commented Jan 24, 2026

Uh oh!

rwinch commented Jan 26, 2026

Uh oh!

gisu1102 commented Jan 27, 2026

Uh oh!

gisu1102 commented Jan 30, 2026

Uh oh!

Uh oh!

rwinch commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gisu1102 commented Jan 23, 2026 •

edited

Loading